US Attorney Damian Williams described this as the first ever conviction for a smart contract hack.
Ahmed forfeited around $12.3 million in stolen funds, and will pay more than $5 million in restitution.
Crema Finance and Nirvana Finance hacker sentenced to three years imprisonment
Shakeeb Ahmed, the hacker who stole a combined $12 million from Crema Finance and Nirvana Finance in July 2022, has been sentenced to three years in prison. Ahmed had previously worked for Amazon, where he led a bug bounty program focused on paying whitehat hackers to discover flaws in Amazon's software.
- "Former Security Engineer Sentenced To Three Years In Prison For Hacking Two Decentralized Cryptocurrency Exchanges", press release from the U.S. Attorney's Office, Southern District of New York [archive]
MarginFi suffers huge outflows amid CEO ragequit
The MarginFi decentralized lending project on Solana has been at the epicenter of some major drama recently, amid concerns around oracle problems, withdrawal failures, and accusations that the project has not been paying out its promised rewards. Much of this came from a Solana staking pool, SolBlaze; MarginFi responded by describing their allegations as a "hit piece" and "misinformation".
On April 10, CEO Edgar Pavlovsky tweeted that he had resigned from MarginFi, publicly calling that he "d[idn't] agree with the way things have been done internally or externally". Pavlovsky had been criticized for his response to the controversy around MarginFi, in which he had been argumentative and insulting, tweeting things like "take your money out, go fuck yourself" to those who accused him and MarginFi of malfeasance.
Amid the chaos, more than $210 million in TVL has exited the protocol.
SEC sends Wells notice to Uniswap
The US Securities and Exchange Commission issued a warning to the Uniswap decentralized exchange in the form of a Wells notice. Wells notices are used to inform the recipient of an impending lawsuit, and give them a last-ditch opportunity to convince the SEC that the suit is unwarranted.
The notice was received with an adversarial posture by Uniswap, who announced its receipt with a blog post titled "Fighting for DeFi". "Taking into account the SEC's ongoing lawsuits against Coinbase and others as well as their complete unwillingness to provide clarity or a path to registration to those operating lawfully within the U.S., we can only conclude that this is the latest political effort to target even the best actors building technology on blockchains," they wrote.
The news was met with outrage in the crypto community, who generally saw the action as indicative of an overly aggressive posture by the SEC to crack down on defi and crypto more broadly.
- "Fighting for DeFi", Uniswap Labs blog [archive]
$23 million goes missing amid STFIL claims that they're being investigated
STFIL, a protocol that promises liquid staking and "leverage mining" to holders of Filecoin's FIL token, announced on Twitter that "We believe that the STFIL core technical team is under investigation by local Chinese police."
According to STFIL, while some of the core team members were detained by Chinese police, FIL tokens were moved to an unknown wallet. They also acknowledged that there had been "abnormal, unscheduled upgrades to the protocol". They asked their community members for help in tracking the wallet.
Some speculated that the story was fake, and that the project had stolen the funds. However, Chinese police have in several instances cracked down on people and companies involved in Filecoin-related projects, including an $83.3 million alleged pyramid scheme in August 2023 and a group of Filecoin Ponzi schemers in 2021. Filecoin mining became popular in China after its 2018 initial coin offering, and also became a magnet for Ponzi schemes and other scams.
MuskSwap and related projects exit scam for over $5 million
A person or group have raised funds for various crypto projects only to abandon them, empty the project wallets, and launder the funds through Tornado Cash. The largest of the projects was called "MuskSwap", which proclaimed: "$MUSK & MuskSwap was born to show admiration to elon musk's super projects like solarcity, tesla, space x and his constant influence on the world finance & the crypto market."
The project described itself as a DEX with a native $MUSK token, and launched in July 2021. However, the token tanked on December 25, 2021. Although the project team tried to blame the crash on "liquidity issues" and promised paths forward, they locked the project Telegram chat on March 11, 2022. On April 5, 2022, the team withdrew remaining funds and deleted the website.
Crypto analysis firm CertiK linked the MuskSwap project to several other scam tokens and projects: RocketDoge, InfinityGame, SpaceX, MUFC (themed after Manchester United), and Elona Musk. Altogether, the rug pulls have drawn in $5.1 million.
Bored Ape-themed fast food restaurant shuts down
It's hard to believe that the hamburger joint themed around the owner's Bored Ape NFT failed to take off. Although there was novelty value in the themed restaurant, which for a time boasted that it accepted cryptocurrency payments, the excitement seemed to wear off quickly after a few early news articles. After a while, the restaurant's crypto payments became spotty, with employees saying the system was unwieldy and unpopular among customers.
Some more recent Yelp reviews described fairly mediocre food, which "[t]he NFTs don't make up for".
The restaurant opened in April 2022, a month after owner Andy Nguyen purchased Bored Ape #6184 for $268,000, along with three Mutant Apes for an additional combined $187,000. #6184 became the restaurant's logo, and the others were incorporated into the restaurant's branding. The NFTs haven't been resold since, although it's unlikely they could recoup close to their original purchase prices — Bored Apes have been averaging a little under $50,000 in recent sales, and Mutants around $8,500 each.
Do Kwon and Terraform Labs found liable for $40 billion fraud
After hearing arguments that Terraform Labs was "built on lies" during a two-week-long trial, the jury in the civil case against the company and its founder Do Kwon found that both were liable for fraud.
Kwon and his company were behind the algorithmic stablecoin, Terra, which dramatically collapsed in May 2022, sending huge ripple effects throughout the ecosystem. He and his company had lied about the stability of the token, ultimately causing massive financial damage to the tune of around $40 billion.
Kwon is in custody in Montenegro after attempting to flee criminal cases in both the United States and South Korea. The civil case in the US proceeded without him.
- "Terraform Labs and founder Do Kwon found liable in US civil fraud trial", Reuters [archive]
- Verdict in Securities and Exchange Commission v. Terraform Labs Pte Ltd. [archive]
SushiSwap team votes to give themselves control of much of the "decentralized" project's treasury
The leadership team behind SushiSwap, a popular defi platform, submitted proposals for a DAO governance vote that would transfer control of around $40 million from the DAO to a small centralized organization called "Sushi Labs". That organization would also receive all future airdrops awarded to SushiSwap. According to the proposal, this was motivated by a desire for efficiency and faster development.
The "yes" votes are currently in the lead with a 63% margin. The most yes votes came from sushigov.eth, the official SushiSwap team address, which also created the proposal. It is the first time that address has ever participated in a governance proposal.
The 5.5 million yes votes from the team wallet, plus another 3.1 million delegated from other community members, were enough to push the vote to majority support. A former SushiSwap contributor has also alleged that the SushiSwap team was manipulating the vote with additional wallets.
On Twitter, Sushi's "Head Chef" claimed that he had consulted with lawyers and then authorized the voting activity out of fear of an "extortative [sic] governance attack attempt".
Project promising to rug pull raises almost $29,000
A project describing itself as "The world's first memecoin pre-announced as a rugpull" was explicit in its marketing: "do not buy this coin, as it will go to zero."
Despite that, people sent the creator over 8.8 ETH (almost $29,000) for the project's "pre-sale", even as they repeated on Twitter that the project was a scam and that no one should buy it.
FixedFloat exchange hacked again
The FixedFloat cryptocurrency exchange was exploited again, this time for around $2.8 million. This follows shortly after a February 18 hack in which attackers made off with $26 million.
FixedFloat acknowledged the theft in a Twitter post, and blamed the same thieves. They claimed that this theft was enabled by a vulnerability in a third-party service.